Record sanitized Git diagnostics for publication recovery

tools/publish_gitea.py

@@ -191,6 +191,12 @@ def publish(args):
             # Commands never contain the credential; do not print captured HTTP/Git output.
             failure = f"{type(error).__name__}: {error}"
             state["failure"] = failure
+            if isinstance(error, subprocess.CalledProcessError) and error.stderr:
+                detail = error.stderr.decode("utf-8", "replace")
+                if token:
+                    detail = detail.replace(token, "[REDACTED]")
+                    detail = detail.replace(base64.b64encode(("gerardo:" + token).encode()).decode(), "[REDACTED]")
+                state["safe_command_stderr"] = detail[-4000:]
         finally:
             if stop is not None:
                 stop.set()